Windows MSHTML Zero-Day Exploited to Install Malware

Check Point Researchers have discovered that a Windows MSHTML zero-day vulnerability has been exploited in malware attacks for over a year. The flaw, tracked as CVE-2024-38112, allows threat actors to bypass built-in security features and launch malicious scripts, which led to the installation of password-stealing malware.

The MSHTML zero-day vulnerability allows attackers to distribute malicious Internet Shortcut Files (.url) that appear legitimate, such as links to download PDF documents. These.url files use the mhtml: URI handler to open links in Internet Explorer instead of modern browsers like Chrome or Edge.

Hackers can also alter the shortcut icon, making it appear like a commonly-used file type or application.

Internet Explorer then downloads an HTA file without adequate security warnings, as its filename is padded with Unicode characters to hide the.hta extension. Users, believing they are opening a legitimate PDF, allow the HTA file to run.

According to BleepingComputer, Check Point Researchers told them that allowing the HTA file to run would install the password-stealing malware Atlantida Stealer. Once this happens, Atlantida Stealer can steal cookies, browser history, cryptocurrency wallets, and other sensitive data, including Steam credentials.

Check Point Researcher Haifei Li published a report on the exploit, revealing that it has been “actively used in the wild for at least one year” and that it “works on the latest Windows 10/11 operating systems.” The security company already released fixes for its customers months ahead of publicizing its results via its Harmony Email and Collaboration security tools.

It also reported the issue to the Microsoft Security Response Center (MSRC) on Thursday, May 16, 2024. After working closely with Check Point on addressing the vulnerability, Microsoft released an official patch on July 9.

Check Point urges Windows users to apply this patch as soon as possible. Concerned individuals should also be extra cautious when encountering.url files sent from untrusted sources. The malware requires multiple user interactions to succeed, so users should treat any suspicious files with extreme caution.

While this vulnerability has been fixed, future planned Windows features may prove to be even more dangerous if they are able to be exploited. Windows Recall, an upcoming AI feature, is being scrutinized for its potential to expose private information to hackers.